How a simple sentence in your privacy notice can restrict your digital marketing: the Belgian DPA issued an injunction to adapt digital marketing practices for a fitness club that had sent marketing e-mails to a club member, including for non-sporting events. The case highlights a classic misalignment between documentation and marketing practices, as well as […]
IAB Europe & TCF case: Belgian Market Court confirms Belgian DPA went too far in seeking enforcement of full range of measures against IAB Europe. Pleased to see the judgment of the Market Court/MC of Wednesday 7 January 2026, which set aside the BDPA’s decision of January 2023 (through which it had validated IAB Europe’s […]
With the festive season upon us, I may be posting a little less and instead singing Christmas songs with the family. So let’s look back at 2025 and anticipate 2026, based on interactions with my LinkedIn articles & posts: – Pseudonymisation & the concept of “personal data” were significant in 2025. 4 of my top […]
Appeal against Belgian DPA decision: important findings on legitimate interest, reasonable expectations and (non-)necessity of verifications of prior lawfulness. In a judgment of yesterday, the Market Court (Brussels Court of Appeal) lifted a reprimand for a company that had used personal data for marketing purposes. The legitimate interest considerations will be of great interest to […]
Podcast time again, with The Monopoly Report on the Digital Omnibus (focus on GDPR and ePrivacy changes). In this episode, Alan Chapell and I discuss the apparent intentions of the Commission, the link with case law of the EU Court of Justice, possible reactions from data protection regulators and more. Its publication this Wednesday ties […]
As I was in a meeting when the European Data Protection Board opened registration for its pseudonymisation stakeholder event of 12 December 2025, I missed the short (approx. 1h) registration window and they placed me on a waiting list instead – a pity given my frequent interventions on the EU Court of Justice’s SRB judgment […]
Myth-busting time! This week, the EDPB published its Opinion on AI models & personal data, and then the Italian authority revealed it had fined OpenAI. But unlike what some are suggesting, the Italian decision *predates* the EDPB Opinion by a month. So let’s dispel a few myths surrounding that Opinion: – “Game changer”? The positions […]
Full analysis likely to come in the coming days, but some first thoughts on the EDPB’s “AI models & personal data” Opinion. In essence, the EDPB doesn’t exclude anything entirely but leaves it up to national supervisory authorities to make a call in cases they are handling – and while it doesn’t prohibit relying on […]
Digital Omnibus & GDPR: I like some things & dislike others about the proposal, but want to push back against claims that the “personal data” definition change will weaken protection. Of course some data protection supervisory authorities will say this (non-personal data generally falls outside of their remit), but is there truly weakening of protection […]
NIS2 vs GDPR: fines/injunctions in Belgium to be challenged before different courts? While the Belgian legislator has gradually been entrusting one single, specialised court with highly regulatory cases (essentially regarding telecom rules, financial services rules and data protection rules), it appears for now *not* to have chosen to entrust that same court, the Belgian Market […]
